8
Change cipher spec protocol Signals transitions in ciphering strategies It updates the CipherSuite that will be used on the current connection

9
Alert Protocol Alert messages communicate the severity of the message and a description of the alert Fatal messages result in connection termination.

10
SSL-Handshake Protocol Establishment of the secure channel between the client and the server Provides the keys and the algorithm information to SSL Record Protocol, above it Enables clients and servers – Negotiate cryptographic algorithms – Optionally authenticate each other – Generate shared secrets using public-key encryption techniques

12
“SSL is Not a Magic Bullet” It provides encrypted connections between two machines It verifies that information transmitted during the session is not being monitored or diverted to a malicious third party. Unfortunately, SSL is not the answer to every security concern.

13
Guarantees of SSL The server you want to contact is the one you got. No attacker can read or modify the data being transmitted between you and the Web server.

15
Host Insecurities Having an SSL- enabled Web server, often just called a 'secure Web server,' does not secure the machine itself. Examples: If a machine running an SSL enabled Web server also runs an IMAP (Internet Mail Access Protocol) server, then that machine becomes vulnerable. IMAP servers are known to be prone to attacks.

16
Authentication Issues The SSL certificate is based on the host name, nothing else. Example: instead of

17
Backend clear-text storage and transmission Many Web servers get and store data using outside sources, such as databases or flat files These files may be sent somewhere else without using a secure channel. Example: credit card information

18
SSL Implementation Flaws Different vendors have their own implementation of SSL,which can have different flaws. OpenSSL has been discovered to have multiple buffer overflow capabilities Microsoft Internet Explorer does not properly check the digital "certificates" which guarantee the security of an SSL connection.

19
Affected Browsers Netscape 4.x and Mozilla are NOT vulnerable. IE 5 and 5.5 are vulnerable straight-up, and IE 6 is mostly vulnerable